Spamhaus Delisting: SBL, CSS, XBL, PBL and DBL Explained

Spamhaus has the widest reach of any blocklist operator, which makes a listing expensive and makes identifying *which* list you are on the first task. The combined zone most receivers query is ZEN, which aggregates the IP lists — so a ZEN hit tells you that you are listed somewhere without telling you where.

The lists

SBL — Spamhaus Blocklist. IP addresses associated with spam sources, typically listed after specific evidence: trap hits, complaint volume, or a persistent pattern. Listings are often accompanied by a reference to the incident.

CSS — Composite Snowshoe Score. Automated, and the one most cold-email senders meet. CSS targets the snowshoe pattern: spreading sending across many fresh domains, subdomains and IPs to keep any single identity's reputation clean. It does not need a complaint to list you; the shape of the sending is the evidence.

XBL — Exploits Blocklist. Compromised machines: infected hosts, open proxies, worm traffic. An XBL listing is a security incident. Somebody is sending through your infrastructure without your knowledge, or your host's neighbour is.

PBL — Policy Blocklist. Ranges that should not be delivering mail directly to the internet — dynamic and residential allocations, and space the owning network has declared non-sending. Being listed is not an accusation; it is a statement about the address. Mail from these ranges belongs in a relay.

DBL — Domain Blocklist. Domains, not IPs. Your sending domain can be listed, and so can a domain that merely appears as a link in your message, which is how senders get caught by a partner's compromised site.

DROP / EDROP. Hijacked and wholly malicious netblocks, published for routers and firewalls rather than mail filters. If you are in DROP, the problem is your network provider.

Identifying your listing

Query the Blocklist Removal Center at check.spamhaus.org with the IP or domain. For a DNS check, the return code names the sub-list: a lookup against zen.spamhaus.org answers 127.0.0.2 for SBL, 127.0.0.3 for CSS, 127.0.0.4 through 127.0.0.7 for XBL variants, and 127.0.0.10 or 127.0.0.11 for PBL. The accompanying TXT record carries the reason and the reference.

Check the exact object: the sending IP from a Received header of real mail, and each sending domain separately.

Removal, by list

PBL has self-service removal. If you genuinely run a mail server on a static address, you can remove it yourself — but check first whether your provider has declared the range non-sending, because they can re-add it. If the range is genuinely dynamic, the honest fix is to relay through a provider.

XBL clears once the compromise is gone. Find the source first: audit SMTP auth logs for credential abuse, check for a web form or CMS being used as a relay, scan hosts on the network. Removal while the infection persists guarantees a relisting within hours.

SBL and CSS require the cause to be fixed and then a removal request through the same portal. For CSS specifically that means the pattern must change:

• Consolidate onto fewer sending domains instead of rotating fresh ones.
• Slow the ramp. A cold domain sending real volume in week one is the core snowshoe signature.
• Purge unverified addresses — trap hits are what put weight behind the pattern.
• Keep authentication aligned, so your mail is attributable rather than looking like one of a thousand disposable identities.

DBL listings expire on their own once the domain stops being seen in spam, and have a removal request path for cases where you have resolved the cause. Check whether the listed domain is actually yours or one you link to.

What gets senders relisted

• Removing the listing but keeping the list that caused it. Trap hits resume immediately.
• Treating a CSS listing as a false positive. CSS is pattern-based; "we are a legitimate business" does not change the pattern.
• Rotating to new domains after a listing. This is the fastest way to turn one listing into a durable one.
• Sending at full volume the moment the listing clears. Reputation at the receiver has not recovered yet, even though the list has.

After delisting

A clean Spamhaus record is not restored reputation. Gmail, Microsoft and Yahoo maintain their own internal scores and they recover more slowly than a DNSBL entry disappears. Expect days to weeks of degraded placement after a significant listing, rebuild volume gradually, and measure per-provider placement rather than assuming parity has returned.

MailPilot checks Spamhaus's zones against your sending domains and IPs daily and tracks per-provider placement alongside them, so you can see both the listing and its actual effect on delivery — and when the effect genuinely ends.